rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via…
Priority LOW 11CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
rssh 2.3.3 and earlier allows local users to bypass intended restricted shell access via crafted environment variables in the command line.
Why it matters now
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pizzashack:rssh:*:*:*:*:*:*:*:* | up to 2.3.2 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.0.2:*:*:*:*:*:*:* | 2.0.2 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.0.3:*:*:*:*:*:*:* | 2.0.3 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.0.4:*:*:*:*:*:*:* | 2.0.4 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.2.2:*:*:*:*:*:*:* | 2.2.2 | Vulnerable | Pizzashack |
- cpe:2.3:a:pizzashack:rssh:*:*:*:*:*:*:*:* Versions up to 2.3.2 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Vulnerable ·Pizzashack
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pizzashack:rssh:2.2.3:*:*:*:*:*:*:* | 2.2.3 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.3.0:*:*:*:*:*:*:* | 2.3.0 | Vulnerable | Pizzashack |
| cpe:2.3:a:pizzashack:rssh:2.3.1:*:*:*:*:*:*:* | 2.3.1 | Vulnerable | Pizzashack |
- cpe:2.3:a:pizzashack:rssh:2.2.3:*:*:*:*:*:*:* Versions 2.2.3 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Pizzashack
- cpe:2.3:a:pizzashack:rssh:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Pizzashack
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2012-3478
- 2026-10-03 Alias added: GHSA-4ffw-7fvq-j2mh
References
Advisory 1
Other 6
- 20120508 rssh security announcement
- [oss-security] 20121127 Re: rssh: incorrect filtering of command line options
- [oss-security] 20120810 Re: CVE Request: rssh command-line parsing vulnerability
- [oss-security] 20120810 CVE Request: rssh command-line parsing vulnerability
- [rssh-discuss] 20120508 Re: rssh security announcement
- 20121127 Re: rssh security announcement
More Pizzashack Rssh vulnerabilities
- TI-2019-02592 Insufficient sanitization of environment variables passed to rsync can bypass the… CVSS 3.1CRITICAL 9.8
- TI-2019-02591 Insufficient sanitization of arguments passed to rsync can bypass the restrictions… CVSS 3.1CRITICAL 9.8
- TI-2004-01504 Format string vulnerability in log.c in rssh before 2.2.2 allows remote authenticated users to execute arbitrary code. CVSS 2.0HIGH 9.0
- TI-2019-15835 rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in… CVSS 3.1HIGH 7.8
- TI-2012-02005 Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is… CVSS 2.0MEDIUM 4.4
- TI-2012-02004 rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled… CVSS 2.0MEDIUM 4.4
Sources
- CVE-2012-3478 · CVE Program
- CVE-2012-3478 · NVD
- FIRST EPSS
- GHSA-4ffw-7fvq-j2mh · GitHub Advisory Database · CC BY 4.0
- CVE-2012-3478 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences